Supply-Chain

The hard part of DNSSEC was finished years ago. Counted from the live root zone on 27 September 2026, 1,351 of 1,438 top level domains carry a DS record and every one of the 1,038 gTLDs is signed. Then it stops dead. A census of every gov.uk domain in the official register finds 39 signed out of 2,390 that still resolve, nine of them parish councils, while HMRC, the NHS, GCHQ and the National Cyber Security Centre are not among them. One certificate authority in nine has signed. So has one Linux distribution in three. windowsupdate.com has no DS at all. This is what a forged answer actually costs, what signing does about it, why the usual excuses do not survive contact with the numbers, and whether forty-two years after Mockapetris the real problem is that almost nobody understands what DNS actually promises.

Part 2 of 3. What actually gets built once the paperwork is signed: cloud for a business with one building, the box they will not be talked out of, the basics that were the thing you bought, and the agent on every machine that answers to somebody else’s console.

Twenty years back you bought software and the copy was yours. Now you rent it, and the supplier sets the terms. Part 1 of 8 walks through how that happened, and why every step made it harder to go elsewhere.

Once moving supplier is hard, the costs change shape. The price follows your exit cost. Profit is declared in one country and earned in another. The law follows who owns the company, not where the building stands. Part 2 of 8, in plain language.

The first 2 posts looked at what dependency costs you. This one looks at who else foots the bill: the volunteers keeping software going for very large companies, and the businesses bought, borrowed against and stripped back. Part 3 of 8, in plain language.

Picking a supplier means guessing how they will behave later. The fairest basis for that guess is what courts and regulators have already decided. Part 4 of 8 sets out the findings, includes the cases regulators lost, and draws the pattern.

Part 2 covered the law that reaches your data. Part 5 of 8 covers the law that reaches your company: large penalties under American law, a French parliamentary report on whether that works as a commercial weapon, trade pressure applied to tax law and to regulators, and products carrying one market’s assumptions everywhere.

Shutting a supplier out on security grounds needs a standard, applied evenly. Part 6 of 8 sets out what has been established about weakened products and interception, including a Swiss parliamentary inquiry, and shows why a built-in way in belongs to whoever reaches it.

None of this is new, and it is not really about technology. Four companies control most of the world’s seed supply. Ten retailers move most of Britain’s food. Both produced a legal answer software has nowt like. Part 7 of 8 compares them, and asks why technology got away with it.

Since 2025 the European answer has turned from plans into things you can install. Part 8 of 8 covers what has landed, what is honestly still years off, and gives 3 questions to work out where you stand.